turns out we need to keep Gemfile.lock in the repo